1. Submission doc.: IEEE 802.11-12/0789r3 NameAffiliationsAddressPhoneemail George Cherian Santosh Abraham Jouni Malinen Qualcomm 5775 Morehouse Dr, San Diego, CA, USA +1 (858)-651-6645gcherian@qualcomm.com sabraham@qualcomm.com jouni@qca.qualcomm.com Fast Authentication in TGai : Updates to EAP-RP Date: 2012-07-16 July 2012 Slide 1 Authors: Qualcomm,

2. Submission doc.: IEEE 802.11-12/0789r3 Goal Updated options on EAP-RP (from 11/1160r9) for discussion (based on feedback received during last meeting) What’s different from earlier proposal? –Explicit unicast ANonce –Optional PFS QualcommSlide 2 July 2012

3. Submission doc.: IEEE 802.11-12/0789r3 Option-1: Fast Association for FILS [Deferred ANonce] Slide 3 Sending of ANonce to STA is deferred until step-7 Step-2: STA generates rMSK based on [RFC 5296] rMSK = KDF (K, S), where K = rRK and S = rMSK label | "\0" | SEQ | length AP generates PTK at step-6 IP-addr assignment req sent at step-9 July 2012 Qualcomm

4. Submission doc.: IEEE 802.11-12/0789r3 Option-2: Fast Association for FILS QualcommSlide 4 [step-3] STA generates rMSK based on [RFC 5296] rMSK = KDF (K, S), where K = rRK and S = rMSK label | "\0" | SEQ | length [step-3a] PTK is generated using rMSK, ANonce & SNonce Key Confirmation: [step-4]: STA applies message integrity on the combined payload that include EAP-Re-Auth, DHCP-Discover & Snonce using KCK [step 8b] AP verifies & performs message integrity check for DHCP & SNonce and decrypt DHCP July 2012

5. Submission doc.: IEEE 802.11-12/0789r3 Comparison between Option 1 & 2 Option-1 is cleaner from messaging standpoint –IP address assignment request initiated after EAP-RP signaling Option-2 enables ANonce filtering that can be applied at AP before forwarding packets to AS –May help reduce the likelihood of DoS attack on AS QualcommSlide 5 July 2012

6. Submission doc.: IEEE 802.11-12/0789r3 PFS addition (based on option-1) Slide 6 PublicKeys are assumed to be ephemeral Diffie Hellman (DHE) public keys Public Key of STA: K STA-pub sent at step-3 Public Key of AP: K AP-pub sent at step-7 Shared Key : K SA generated by AP at step-6 Shared Key : K SA generated by STA at step-8 Computation of PTK includes rMSK, Snonce, Anonce & K SA July 2012 Qualcomm

7. Submission doc.: IEEE 802.11-12/0789r3 PFS addition (based on option-2) QualcommSlide 7 PublicKeys are assumed to be ephemeral Diffie Hellman (DHE) public keys Public Key of STA: K STA-pub sent at step- 2a Public Key of AP: K AP-pub sent at step-2b Shared Key : K SA generated by AP at step-8a Shared Key : K SA generated by STA at step-3a Computation of PTK includes rMSK, Snonce, Anonce & K SA July 2012

8. Submission doc.: IEEE 802.11-12/0789r3 Motion-1 Add the following text to Subsection 4.1 “Pre- established security context” –The draft specification shall include support for the EAP-RP [as defined in IETF RFC 5295/5296] for fast key establishment. a nonce exchange and key confirmation that does not degrade the security of the 4-way handshake. Moved : Seconded: Yes No Abstain QualcommSlide 8

9. Submission doc.: IEEE 802.11-12/0789r3 Motion-2 Add the following text to Subsection 4.1 “Pre- established security context” –The draft specification shall include optional support of PFS as part of key establishment. Moved : Seconded: Yes No Abstain QualcommSlide 9

10. Submission doc.: IEEE 802.11-12/0789r3 Motion 3 Add the following text to Subsection 4.1 “Pre- established security context” –The key derivation handshake is started by ‘sending of Snonce first’ when EAP-RP is used for authentication Moved : Seconded: –Yes: –No: –Abstain: QualcommSlide 10

11. Submission doc.: IEEE 802.11-12/0789r3 Motion 4 Add the following text to Subsection 4.1 “Pre- established security context” –Non-AP STA shall support bundling of EAP-Reauth Initiate message with the Snonce in the Auth frame Moved : Seconded: –Yes: –No: –Abstain: QualcommSlide 11